AIAA 2002-4412 


MARS SMART LANDER SIMULATIONS FOR ENTRY, DESCENT, AND LANDING 

S. A. Striepe,* D. W. Way,* A. M. Dwyer,* and J. Balaramf 


Abstract 

Two primary simulations have been developed and are being updated for the Mars Smart 
Lander Entry, Descent, and Landing (EDL). The high fidelity engineering end-to-end EDL simu- 
lation that is based on NASA Langley’s Program to Optimize Simulated Trajectories (POST) and 
the end-to-end real-time, hardware-in-the-loop simulation testbed, which is based on NASA JPL’s 
Dynamics Simulator for Entry, Descent and Surface landing (DSENDS). This paper presents the 
status of these Mars Smart Lander EDL end-to-end simulations at this time. Various models, ca- 
pabilities, as well as validation and verification for these simulations are discussed. 



NOMENCLATURE 

AGL 

Above Ground Level 

CFD 

Computational Fluid Dynamics 

DEM 

Digital Elevation Map 

DOF 

Degree of Freedom 

DSENDS 

Dynamics Simulator for Entry, 


Descent and Surface landing 

EDL 

Entry, Descent, and Landing 

ETPC 

Entry Terminal Point Controller 

GCM 

Global Circulation Model 

IMU 

Inertial Measurement Unit 

JPL 

Jet Propulsion Laboratory 

Mars-GRAM 

Mars Global Reference Atmosphere 


Model 

MOLA 

Mars Observer Laser Altimetry 

MSL 

Mars Smart Lander 

POST 

Program to Optimize Simulated 


Trajectories 

INTRODUCTION 

The Mars Smart Lander (MSL) mission will de- 
liver an advanced rover to a specified Martian site with 
an accuracy never before achieved by using a guided 
aeromaneuvering lander. [Ref. 1] Currently slated for a 
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2009 launch, this mission uses an onboard guidance 
during entry and terminal descent phases to direct the 
spacecraft to the desired landing site, while avoiding 
any surface hazards detected by the onboard systems. 
The guidance controls the vehicle through lift vector 
modulation during the entry phase and thrust vector 
pointing during the terminal descent. Figure 1 shows an 
illustration of the Entry, Descent, and Landing (EDL) 
for the Mars Smart Lander. This mission will demon- 
strate some of the precursor steps required for a Mars 
sample return mission. 

Current approaches to EDL at Mars have focused 
on unguided and uncontrolled ballistic entry with no 
precision landing or hazard avoidance capabilities. The 
new generation of "Smart" Landers with their lifting 
body designs, aerodynamic steering, active terrain 
sensing, and powered-descent/precision-landing capa- 
bilities requires a new generation of simulation tech- 
nology to support their development. The EDL systems 
are required to successfully deliver the surface systems 
through the entry, descent, and landing phases, which 
begin at lander separation from the cruise stage and end 
at touchdown on the surface. For MSL, these EDL sys- 
tems will be designed, developed, tested, and evaluated 
using end-to-end high fidelity computer flight simula- 
tions developed by a team of engineers from NASA- 
JPL, NASA-JSC, NASA-Langley, and the University 
of Texas at Austin. 

Two primary EDL simulations have been devel- 
oped from existing tools and are being updated specifi- 
cally for the MSL project. The first of these simulations 
is the high fidelity engineering end-to-end EDL simu- 
lation, which is based on NASA-Langley’s Program to 
Optimize Simulated Trajectories (POST) [Refs. 2 and 
3], The second program is the end-to-end real-time, 
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hardware-in-the-loop simulation testbed, which is based 
on NASA-JPL’s Dynamics Simulator for Entry, De- 
scent and Surface landing (DSENDS) [Ref. 4]. Models 
of various MSL EDL systems are provided by groups 
responsible for their technology or flight development. 
Initially, these models are incorporated into the high- 
fidelity engineering (POST-based) simulation for 
evaluation and development. Eventually, these models, 
as well as flight-ready algorithms and hardware, will be 
incorporated into a real-time simulation capable of sup- 
porting detailed dynamics, device models and hard- 
ware-in-the-loop simulations (Mars-DSENDS) for 
flight operation evaluation, testing, and refinement. 
During the Mars Smart Lander mission, both simula- 
tions will support flight operations and anomaly resolu- 
tion. This paper describes these two end-to-end simula- 
tions as well as the models, algorithms, and hardware 
they incorporate to test and evaluate the Lander during 
simulated Mars entries. 

BACKGROUND 

Traditionally, disparate simulation tools have been 
exercised in an ad-hoc manner on the separate portions 
of a typical EDL profile. This approach has resulted in 
a patchwork of tools, with complex, hand-crafted inter- 
faces requiring manual transfer of data products across 
simulation systems. Such an approach was difficult 
even for the relatively simple requirements of the Mars 
Pathfinder style missions. This approach will be totally 
inadequate for the Smart Lander missions where exten- 
sive, closed-loop actions by the spacecraft requires in- 
timate integration of all the supporting simulation ele- 
ments. 

The objective of the MSL EDL simulations is to 
support Lander systems design, trade studies, develop- 
ment, testing, and operations by establishing end-to-end 
simulations that include high fidelity models of the 
Mars Smart Lander systems and the Mars environment. 
To support this objective, a capability to provide end- 
to-end engineering simulation of all phases of EDL 
flight throughout the MSL project lifecycle is required. 
This engineering simulation is needed to enable rapid 
initial screening to define critical mission and lander 
parameters and sensitivities for conceptual design and 
system level trades. Not only is this high fidelity simu- 
lation necessary for detailed lander design, mission 
statistics, and operations support, but also to verify in- 
tegration of EDL subphases performance (such as the 
control system during entry or the parachute during 
descent) through evaluation of lander systems and con- 
figurations in an end-to-end environment. Also needed 


to support the objective above is a real-time, hardware- 
in-the-loop end-to-end EDL simulation to allow sys- 
tems level tests of flight hardware and software compo- 
nents, flight software checkout prior to upload, and 
systems level troubleshooting during operations. Over- 
all Lander system risk is reduced by fully integrating 
not only detailed engineering models of the subsystems, 
but the actual hardware for testing in the simulated mis- 
sion environment from cruise stage separation through 
lander touchdown. These end-to-end system level 
simulations also provide inputs as well as independent 
validation and verification of subphase simulations used 
for subsystem design, algorithm development, and de- 
tailed component level analyses. Additionally, the 
simulations receive input conditions from interplanetary 
trajectory and cruise stage system simulations while 
providing inputs to Rover egress simulations. These 
simulations enable designers and mission managers to 
evaluate specific and overall lander systems perform- 
ance in the expected Mars environment. These objec- 
tives and simulation requirements are met for MSL by 
the high-fidelity engineering (POST-based) and real- 
time, hardware-in-the-loop testbed (DSENDS-based) 
end-to-end EDL simulations. 

The high-fidelity engineering (POST-based) end- 
to-end EDL simulation provides mission level feasibil- 
ity, design trades, guidance and control algorithm de- 
velopment and analysis capability, as well as success 
criteria evaluation of flight systems using rapid Monte 
Carlo analyses. The POST tool developed at NASA 
Langley has been successfully used for mission design, 
operations, trajectory determination/ optimization and 
Monte-Carlo analyses in many recent Mars missions. 
These missions include the Mars Pathfinder, Polar 
Lander, Odyssey Orbiter, proposed 2001 Lander, and 
MER 2003 Lander missions. POST has also been used 
for a number of non-Mars missions involving atmos- 
pheric entry (e.g.. Stardust, Genesis, etc.). [Refs. 5-19] 

In turn, the real-time, hardware-in-the-loop 
(DSENDS-based) end-to-end EDL simulation allows 
detailed system integration analyses and testing for the 
Mars environment. The DSENDS (Dynamics Simulator 
for Entry Descent and Surface landing) real-time simu- 
lation tool is an extension of the Darts/Dshell multi- 
mission spacecraft simulation tool developed at NASA- 
JPL. This tool has been used on the Cassini mission, 
which will study Saturn and send an entry probe into 
Titan’s atmosphere. DSENDS is capable of providing 
detailed spacecraft system/device simulation (sensor, 
actuators, communication devices, flex/rigid multi-body 
dynamics, aerodynamics, etc). Additionally, flight soft- 


2 

American Institute of Aeronautics and Astronautics 


ware can be embedded in the simulation creating a 
system integration testbed to support flight system vali- 
dation, ATLO, and mission operations. 

The current MSL EDL simulation strategy has sev- 
eral strong advantages. The use of POST-based and 
DSENDS-based end-to-end simulations in conjunction 
with independent subphase simulations enables each 
critical segment of EDL to be covered by three simula- 
tions for synergistic purposes. The independent devel- 
opment of these simulations provides a strong basis for 
independent validation and verification of all simula- 
tions. End-to-end simulations provide coordination with 
specialized subphase simulations leading to early iden- 
tification of interface issues as well as subsystem con- 
flicts from one phase of EDL to the next. Figure 2 il- 
lustrates the coverage that the two end-to-end simula- 
tions provide and their interaction with more specific 
subphase simulations. Although these end-to-end 
simulations are undergoing further improvements, the 
design engineers and project managers are receiving 
useful simulation results even as the simulations are 
being updated and their fidelity is increasing. By pro- 
viding these results in the early phases, the project 
schedule is less likely to be impacted by system level 
EDL design issues late in the design cycle. 

The following two sections describe the POST- 
based and DSENDS-based simulations for Mars Smart 
Lander Entry, Descent, and Landing in more detail. The 
third section includes information about the validation 
and verification approach for these simulations. 

PART 1. HIGH FIDELITY ENGINEERING 
(POST-BASED^ END-TO-END EDL 
SIMULATION 

The Program to Optimize Simulated Trajectories 
was initially developed in the 197CTs to support Space 
Shuttle development. [Ref. 2] It has been continually 
upgraded and modified since then to support a large 
variety of aerospace vehicle development and opera- 
tions through trajectory simulation, analyses, and sys- 
tem performance assessments. [Ref. 3] POST contains 
many basic models (such as atmosphere, gravity, and 
navigation system models) that are used to simulate a 
wide variety of launch, orbital, and entry missions (see 
Fig. 3). 

However, exploiting the modular nature of the 
POST program by adding mission specific models in 
concert with the existing POST architecture allows for 
the development of higher fidelity, mission specific 
simulations. These simulations support design, devel- 


opment, testing, and operations of vehicles for particu- 
lar missions. Simulation complexity varies from first- 
order trades (e.g. parachute size and deployment condi- 
tions, terminal descent engine size, etc.) to all-up 
Monte-Carlo simulations to day-of-entry operations. 

The models required for these simulations depend 
on the desired fidelity of the analysis. In the initial 
phases of mission definition and vehicle conceptual 
design, basic models already available in POST are 
used without modification to provide a tool for top level 
trades and conceptual level design. By using existing 
models, rapid turnaround vehicle assessment and design 
simulations are possible. These engineering models can 
be rapidly adapted for performance evaluation and top- 
level trades of new designs. As the mission and systems 
get better defined and higher fidelity models become 
available, they are incorporated into the POST simula- 
tion to perform more mission specific trades and analy- 
ses of the updated systems. Eventually, three and six 
degree-of-freedom (3- and 6-DOF) simulations which 
span an entire phase of a mission (such as entry, de- 
scent and landing at Mars from the final exoatmos- 
pheric trajectory correction maneuver to lander touch- 
down) using the latest engineering models of onboard 
systems are available for detailed mission trades, sys- 
tem analyses, system testing, and mission operations. 
This approach has been and is being applied to the Mars 
Smart Lander mission for the Entry, Descent, and 
Landing high fidelity engineering simulation using 
POST as the main simulation engine. 

The POST-based simulation tools have been used 
to support all elements of the design life cycle for a 
wide variety of missions. Early conceptual studies have 
been conducted using models in the basic production 
version of POST. [Refs. 5-9] Higher fidelity simula- 
tions have included many mission specific models and 
data including aerodynamic parameters from wind tun- 
nel testing and Computational Fluid Dynamics (CFD) 
runs, vehicle mass properties, parachute, control sys- 
tems, and onboard propulsion systems as these data and 
models became available. [Refs. 10-15] POST-based 
simulations have been exercised for extensive Monte- 
Carlo runs including those for “stress tests” that deter- 
mine the limits of system capability. [Refs. 13-18] The 
technical capabilities of POST have already been vali- 
dated against other Mars mission data. [Refs. 16-19] 
Note that these references focus mainly on Mars mis- 
sions, whereas a much larger set of references exists for 
other applications in which POST is used, such as Earth 
launch and entry vehicle development as well as entry 
systems for other planetary missions. 
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The Mars Smart Lander mission is illustrated in 
Fig. 1. The current EDL timeline is shown in Table 1. 
As noted in the timeline, two configurations are cur- 
rently included in the POST-based MSL high fidelity 
end-to-end EDL engineering simulation. The simulation 
starts at cruise stage separation, whereas the actual en- 
try begins at atmospheric interface when aerodynamic 
forces (albeit small at altitudes over 60 km) are acting 
on the vehicle. During atmospheric entry, the flight path 
is controlled by the entry guidance until it commands 
supersonic parachute deploy (nominally around 9 km 
above the ground). Next, the backshell and supersonic 
parachute separate from the lander and deploy the sub- 
sonic parachute around Mach 0.8. Ten seconds later, 
the heat shield is jettisoned. The radar begins to get 
usable altitude and velocity data about three seconds 
later when the heat shield is clear. Upon command of 
the terminal descent guidance, the main engines are 
started at 20 percent thrust. After two seconds, the sub- 
sonic parachute is released and the preliminary touch- 
down target is identified. When hazard avoidance is 
included, the system will use LIDAR to scan the sur- 
face to determine if the preliminary target is suitable. If 
not, a new target will be established and the lander will 
be diverted to it. In the simulation, a single divert ma- 
neuver of 100 m (horizontal distance) at 300 m above 
ground is used in the Monte Carlo analyses to simulate 
the divert capability. During terminal descent, guidance 
is commanding the thrust vector (magnitude and direc- 
tion) to reach the target point such that a constant ve- 
locity, vertical motion only phase is started at 5 m 
above the ground. The radar stops returning useful data 
at about 10 m above the surface. All engines are shut 
off when the lander is one meter above the surface. To 
assess the current configurations under consideration, 
an EDL Challenge Site has been identified (which is 
about 2500 m above the MOLA areoid) as the nearly 20 
km wide crater at 41.45° S latitude and 286.5° E longi- 
tude. The entry and terminal descent guidances are con- 
figured to land inside the Challenge crater. 

The MSL high fidelity engineering simulation of 
these EDL events currently includes various engineer- 
ing models at varied levels of complexity. Both 3 DOF 
and 6DOF simulations, which start at lander separation 
from the cruise stage and finish at touchdown on the 
surface, are under development, with the 3DOF simu- 
lation the most mature at this point. As mentioned 
above, the latest engineering models are incorporated 
into these simulations, or existing models in POST are 
used until the engineering model is developed. The ve- 
hicle specific models include terminal descent and entry 
guidance algorithms, flight navigation filter, sensors, 


inertial measurement unit (IMU), vehicle aerodynamics 
(entry, parachute, and terminal descent configurations), 
parachute dynamics, as well as various control system 
and propulsion system models. The environment mod- 
els in the simulation include high fidelity gravity mod- 
els, Mars-GRAM atmosphere models, and surface to- 
pology based on MOLA data. Table 2 shows the re- 
sponsible groups for various vehicle specific models. 
Several of these models are briefly described below, 
whereas references are provided for details of other 
models. 

The POST-based simulation has been used to pro- 
vide a variety of products to the Mars Smart Lander 
project. These products include: entry and terminal de- 
scent vehicle designs and trades; entry aeroshell con- 
figuration trades; guidance and control algorithm de- 
velopment; parachute sizing trades; terminal descent 
engine trades; project Monte Carlo statistics (precision 
landing, touch down velocity, etc.). Current plans are to 
continue to supply mission and vehicle trade studies, as 
well as provide inputs to the design process (e.g., heat- 
shield thermal protection system sizing). The POST- 
based simulation will also be used in the operations 
phase to support day-of-entry preparation and analyses. 
The POST-based simulation is also providing validation 
and verification support to the real-time, hardware-in- 
the-loop (DSENDS-based) simulation; further discus- 
sion on this support is provided in the third part of this 
paper (POST-DSENDS Validation and Verification). 

Gravity Model 

The gravity model in the POST-based simulation 
uses zonal, sectoral, and tesseral harmonic terms to 
determine the acceleration due to gravity. This model is 
based on the one used in the Artificial Satellite Analysis 
Program (ASAP). [Ref. 20] The 50-by-50 Mars gravity 
field used in the simulation is the MARS50C model 
established to support the Mars Polar Lander mission. 
[Ref. 21] This gravity model will be updated as higher 
order data (such as the 75 x 75 gravity model used to 
support the Mars Odyssey mission) becomes available. 

Planet Model 

An oblate spheroid Mars model is also used in the 
POST-based simulation. This planet model defines the 
physical dimensions (e.g., equatorial radius, polar ra- 
dius) and characteristics (e.g., rotation rate) of Mars. 
This model is not only used for latitude and longitude 
determinations, but is also necessary to determine Mars 
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relative velocity used by the guidance algorithms and 
other simulation models. 

The local altitude is determined using Mars Ob- 
server Laser Altimetry (MOLA) topography data and a 
reference areoid model. The recent availability of elec- 
tronic topographic data provided by the MOLA project 
[Ref. 22] has enhanced POST simulations by allowing 
the calculation of vehicle height above local features at 
Mars. There are three primary surface references for 
measuring altitude: the areoid, the reference ellipsoid, 
and the surface. The areoid (or Mars geoid) is a gravi- 
tational equipotential surface, analogous to the theoreti- 
cal mean sea-level surface on Earth. A “plum bob” 
would hang perpendicular to its surface at every point. 
The angle between this vertical and the equator defines 
the astronomical latitude. The MOLA areoid is defined 
to be a surface with the same gravitational potential as 
the mean equatorial radius (3396 km) and is determined 
from an 80 by 80 coefficient representation of the 
gravitational field. The geocentric radius to the areoid is 
provided as a dataset at 1/16 degree resolution. The 
reference ellipsoid, used within MarsGRAM and POST, 
is an engineering approximation of the areoid. The sur- 
face of the ellipsoid is completely defined by an equato- 
rial radius of 3396 km and a polar radius of 3378.32 
km. The normal vector to the ellipsoid is the direction 
that a plumb bob would hang if it where not for local 
gravitational anomalies. The angle between this normal 
vector and the equator defines the geodetic latitude, 
which is the basis for most maps and charts. The 
MOLA dataset provides a planet-wide model of the 
Mars surface topography at 1/32 degree resolution, ex- 
pressed relative to the areoid. 

The problem of determining the vehicle’s altitude 
above the surface, in the geodetic sense, requires an 
iterative solution. A declination to the surface (the an- 
gle between the radius vector and equatorial plane, 
declnstar) is first guessed which defines a point be- 
neath the spacecraft, measured in the geodetic sense. 
(See Fig. 4.) The length of the vector measured geo- 
centrically to this point from the center of the planet is 
calculated geometrically using the law of sines: 

, ^ sin(0) 

rcalc = gcrad . — 
sin(0) 

where 

rcalc = calculated radius to surface 
gcrad = geocentric radius to spacecraft 


P = center-spacecraft-subsurface angle (angle 
between gcrad and hgtagl) 

6 = center-surface-spacecraft angle (angle 
between rcalc and hgtagl) 

This calculated radius is compared to the sum of 
the radius to the areoid plus the topographic altitude, 
determined from the MOLA dataset at the geocentric 
latitude equal to the guessed declination. A bisection 
root finding method is used to drive the error between 
the calculated and actual radii to zero. Once the surface 
declination is known, the altitude of the spacecraft, 
measured geodetically, is calculated from the law of 
cosines 

hgtagl 2 = gcrad 2 + rcalc 2 - 2gcrad • rcalc cos(a) 


where 

hgtagl = height above ground level (AGL) 

gcrad = geocentric radius to spacecraft 

rcalc = calculated radius to surface 

a =spacecraft-center-surface angle (angle be- 
tween gcrad and rcalc) 

Atmosphere Model 

The Mars Global Reference Atmosphere Model 
[Ref. 23] version 2001 (Mars-GRAM 2001) has been 
included in the simulations (as FORTRAN subroutines 
in POST). Mars-GRAM provides all of the atmospheric 
data (temperature, density, pressure, and wind velocity) 
as well as random perturbations to certain atmospheric 
quantities (e.g., density) while including seasonal, diur- 
nal, latitudinal, and longitudinal variations. The atmos- 
pheric data is a function of the spacecraft location 
(latitude, longitude, and altitude) as well as other user 
supplied inputs. [Ref. 24] These inputs include the date 
of Mars arrival, the minimum update distance for dis- 
persion calculations, a scale factor on the atmospheric 
dispersions, interpolation option for the upper atmos- 
phere, and the fl0.7-cm solar flux value. In addition, 
the capability to model the effect of dust opacity or dust 
storms is included. The Mars arrival date and fl0.7-cm 
solar flux values reflect the period during the solar cy- 
cle in which the entry occurs. 
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The Mars-GRAM subroutine is a parameterization 
of the atmospheric properties, so that the model runs 
relatively quickly and the overall simulation speed is 
not hampered by the atmospheric subroutine. Recent 
versions of Mars-GRAM include density profile data 
from more detailed simulations using global circulation 
models (GCM) being developed at the NASA Ames 
Research Center (by Robert Haberle and James Mur- 
phy) and at the University of Arizona (by Steve 
Bougher); that is, Mars-GRAM can reproduce the more 
realistic densities from the GCM for a specific entry 
profile in the simulation but in a fraction of the time. 
These recent versions also include atmospheric wave 
models which incorporate wave effects on atmospheric 
density. The latest Mars-GRAM version includes the 
1/2 degree resolution topographic data for Mars from 
the Mars Observer Laser Altimetry (MOLA) instrument 
onboard the Mars Global Surveyor spacecraft in orbit 
about Mars. The dust opacity parameter is used to de- 
fine the amount of airborne dust particles so that Mars- 
GRAM can simulate their affect on the atmospheric 
properties. 

Two significant adjustments have been made to 
support Mars-GRAM inclusion in the high fidelity en- 
gineering MSL EDL end-to-end simulation. First, a 
wrapper subroutine was developed to provide a soft- 
ware interface between the Mars-GRAM program, de- 
veloped by Jere Justus (through the NASA Marshall 
Space Flight Center) and the POST-based simulation. 
The wrapper converts between the double precision 
variables used in the flight simulation and the single 
precision variables used by Mars-GRAM, and it pro- 
hibits Mars-GRAM from being called too frequently 
while dispersed density atmospheres are generated 
during Monte Carlo analyses. Second, a higher resolu- 
tion MOLA topography data (1/16 degree resolution) 
was added to the Mars-GRAM 2001 software. Jere 
Justus suggested the necessary subroutine adjustments 
that were implemented to include this newer data. The 
1/16 degree resolution MOLA data includes most of the 
surface features (e.g., craters) found in higher resolution 
data (such as 1/32 degree resolution), while requiring a 
manageable amount of computer memory. 

Aerodynamic Model 

A FORTRAN subroutine supplies aerodynamics 
data to the POST-based simulation. [Ref. 25] Whereas 
different subroutines are supplied depending on the 
configuration to be simulated, the basic difference be- 
tween routines is the data included for the specific con- 
figuration. The routine uses first derivative, or C(l), 


continuous interpolations between a database of dis- 
crete solutions. This interpolation scheme is applied to 
free molecular solutions for the rarefied region of the 
atmosphere, and computational fluid dynamic (CFD) 
solutions combined with wind tunnel test results for the 
continuum regime. A modified Lockheed bridging 
function [Ref. 26] is used in the transitional region be- 
tween rarefied and continuum regimes. The various 
flow regimes are delineated according to Knudsen 
number. 

Entry capsules for robotic missions tend to spend a 
significant amount of time in rarefied and transitional 
flow regimes. Therefore, free molecular values are in- 
cluded in the aerodynamic databases. The aerodynamic 
data in the rarified regime are a function of vehicle at- 
titude. In the transitional regime, the aerodynamic data 
are a function of both vehicle attitude and Knudsen 
number. 

For the continuum region, static aerodynamic data 
were obtained from CFD solutions using the Langley 
Aerothermodynamic Upwind Relaxation Algorithm 
(LAURA) [Ref. 27-29] and tests conducted in the 
NASA Langley’s Unitary-Plan Wind Tunnel (UPWT) 
[Ref. 30]. LAURA was used to generate aerodynamic 
databases for the Mars Pathfinder [Ref. 31], Mars Mi- 
croprobe [Ref. 26], and Stardust [Ref. 32] entry cap- 
sules. Confidence in the LAURA solutions comes from 
validations with Viking data, wind tunnel data, and 
Mars Pathfinder mission results. [Ref. 33] Dynamic 
aerodynamic quantities were included from the data 
generated for the Viking missions. 

Parachute aerodynamic data is taken from Viking 
and Mars Excursion Rover (MER) mission data. Super- 
sonic parachute data is taken from existing disk-gap- 
band parachutes from the Mars Pathfinder mission [Ref. 
34] and planned for the MER mission in 2003. The sub- 
sonic parachute is a ringsail parachute of the type used 
in Apollo, Gemini, and Mercury [Ref. 35] with para- 
chute area scaled for the mass of the MSL entry system. 

Terminal descent phase aerodynamics were taken 
from Viking mission data. Prior to heatshield separa- 
tion, the entry phase aerodynamics is used. After heat- 
shield separation, the data from wind tunnel tests con- 
ducted on a Viking lander inside a backshell was incor- 
porated into the aforementioned aerodynamics subrou- 
tine format. [Ref. 36] 
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Control System 

Reference 37 describes the 6 DOF entry control 
system under development, whereas reference 38 dis- 
cusses the 6 DOF terminal descent controller being 
designed. While higher fidelity 6-Degree-of-Freedom 
(DOF) simulations with entry and terminal descent 
control systems are being developed, a lower fidelity 3- 
DOF simulation that executes faster while providing 
similar results is desired. That is, a model that simulates 
the behavior of a 6-DOF controller in a 3-DOF simula- 
tion of the EDL phase of a planetary entry vehicle is 
wanted. For the entry phase, a pseudo-controller of 
bank angle is employed. Whereas, the terminal descent 
controller in 3-DOF simulations controls attitude of all 
three axes. Both of these controller models were devel- 
oped and integrated within POST to respond to vehicle 
guidance commands in a 3-DOF POST simulation. 

During the entry phase, vehicle attitude in the 3- 
DOF simulation is determined by balancing the aerody- 
namic moments acting on the vehicle (i.e., flying in an 
aerodynamic trim attitude) for angle of attack and 
sideslip angle while a pseudo-controller is employed for 
the commanded bank angle. Work with previous 6 DOF 
simulations has shown that aerodynamic trim condi- 
tions generally occur at about the mean attitude when 
rotational dynamics are included. Therefore, results 
from 3 DOF simulations using aerodynamic trim trans- 
late better to the 6 DOF simulation than constant atti- 
tude 3 DOF runs. The single axis controller determines 
the appropriate bank angle and bank rate change for the 
input maximum acceleration and bank rate (5 deg/s 
and 20 deg/s for MSL) using an Euler integration 
scheme. The maximum acceleration is assumed until 
either maximum rate is achieved or the controller de- 
termines that maximum deceleration must begin to 
reach the commanded bank angle. This pseudo- 
controller model was also used in the MSP’01 Lander 
simulation. [Ref. 14] 

A terminal descent controller was developed and 
integrated within POST that models the 6-DOF rota- 
tional dynamics of a vehicle in a 3-DOF simulation. 
This terminal descent controller may operate in either 
of two modes: acceleration control or throttle control. 
In the first mode, the controller solves for only the an- 
gular acceleration vector needed to obtain the com- 
manded attitude, within prescribed angular velocity and 
acceleration limits. This acceleration vector is then used 
to update the vehicle’s attitude. This mode is advanta- 
geous when only limited information is known about 
the vehicle’s propulsion system, attitude control system, 


and moments of inertia. In the second mode, the con- 
troller first determines the necessary angular accelera- 
tion and then solves for the actual terminal descent en- 
gine throttle settings that would provide the correct 
angular acceleration and commanded thrust, within 
prescribed minimum and maximum throttle limits. 
These throttle settings are used to determine the actual 
angular acceleration, which is then used to update the 
vehicle’s attitude. This mode requires detailed knowl- 
edge of the magnitude and direction of thrust and mo- 
ments provided by each engine that is being manipu- 
lated by the controller. 

In either acceleration control or throttle control, the 
terminal descent controller must first determine the 
desired angular velocity vector necessary to achieve the 
commanded attitude. The direction of the angular ac- 
celeration vector is chosen such that the resultant an- 
gular velocity vector lies along the single axis-of- 
rotation between the current attitude and the com- 
manded attitude. The single axis-of-rotation is found 
from the vector component of the quaternion that, when 
multiplied by the current attitude quaternion, produces 
the commanded attitude quaternion. The magnitude of 
the acceleration vector is determined from the angular 
error between the commanded and current attitudes, a 
controller gain, and the maximum allowable angular 
velocity. The strategy employed is to complete a certain 
percentage of the desired angular rotation, controlled by 
the gain, within the current time step. However, if the 
maximum angular velocity would be exceeded, the an- 
gular rotation is limited to the product of the maximum 
angular velocity and the time step. This acceleration 
vector is finally scaled such that the maximum compo- 
nent of acceleration along each axis is not exceeded. 

Guidance Algorithms 

The guidance algorithm for the entry phase (known 
as the Entry Terminal Point Controller, or ETPC) de- 
termines if modifications to the current atmospheric 
flight path are required and directs the control system to 
make attitude adjustments based on the navigation sys- 
tem input and the desired target location. As illustrated 
in Fig. 5, this system modulates the vehicle bank angle 
(direction of the lift vector, <|>) such that the vehicle ad- 
justs its atmospheric trajectory. In this manner, the ve- 
hicle can accommodate off-nominal entry-state or at- 
mospheric-flight conditions and achieve a significant 
reduction in landed footprint over non-lifting (ballistic) 
or constant bank angle (Viking-type) entries. Maximum 
control authority occurs when the vehicle is traveling at 
hypersonic speeds through the peak dynamic pressure 
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(and peak deceleration) portion of the atmospheric en- 
try. The ETPC algorithm is derived from the final phase 
logic of the Apollo command module entry guidance. 
Bank angle commands for terminal point range control 
are derived with a linear perturbation algorithm using 
influence coefficients of drag acceleration and altitude 
rate errors with respect to a fixed nominal reference 
trajectory as a function of relative velocity. Crossrange 
control is accomplished with bank reversals at target 
out-of-plane corridor limits; however, a final heading 
alignment phase is used to null terminal crossrange 
errors. Additionally, the guidance initiates the super- 
sonic parachute deployment to achieve minimum target 
range within supersonic parachute deploy constraints 
(Mach number and dynamic pressure constraints are 
implemented implicitly as relative velocity and drag 
acceleration corridors). Further detail of the ETPC is 
given in reference 39. 

For the terminal descent phase, the guidance algo- 
rithm is not only used to ensure a successful touch- 
down, but also provides a capability to divert away 
from detected hazards. The guidance commands an ac- 
celeration profile based on navigation estimates of po- 
sition and velocity. This desired acceleration is imple- 
mented via appropriate throttle settings on the six main 
terminal descent engines. The control system is as- 
sumed to align the thrust vector to the commanded ac- 
celeration direction via the appropriate vehicle attitude. 
A commanded divert or change in the descent profile to 
avoid a hazard is reflected in the acceleration profile 
commanded by the guidance. In the final five meters, a 
constant velocity descent is commanded until the en- 
gines are shut off at one meter. Further detail on the 
terminal descent guidance is given in reference 38. 

Navigation System 

A model of the onboard inertial measurement unit 
(IMU) and navigation system is included in the simula- 
tion. This model uses an estimate of the initial states 
that would be determined as the spacecraft approached 
Mars, whereas the simulation uses an actual or delivery 
state provided by the interplanetary trajectory analysis. 
A model of the IMU provides adjustments to simulation 
generated quantities to account for sensor errors. The 
output from the IMU model is used by the navigation 
system model to produce an estimate of the vehicle 
state for use by other onboard system models (such as 
guidance algorithms, control systems, etc.). More de- 
tailed information about IMU/navigation system mod- 
els can be found in reference 40. 


Monte Carlo Dispersions 

A Monte Carlo dispersion analysis is used to quan- 
tify the acceptability and robustness of a given vehicle 
configuration, as well as determine areas of risk associ- 
ated with certain designs and mission phases. These 
dispersion analyses are obtained by randomly varying 
key parameters and characteristics of the environment 
as well as the vehicle assuming a normal or uniform 
distribution of these quantities. The engineers responsi- 
ble for the subsystem models identify the 3-sigma or 
maximum/minimum values of the uncertainties for 
these key parameters. These inputs are then used in the 
MSL end-to-end EDL engineering simulation to deter- 
mine various outputs of the trajectory. The outputs are 
compared with given metrics for each; thus, the suit- 
ability of the vehicle and mission can be assessed. A 
similar approach has been applied to the entry phase of 
several previous missions. [Refs. 5-8, 11, 14] 

Table 4 indicates the parameters currently varied in 
the POST-based simulation during the Monte Carlo 
analyses. This table also shows the nominal value, type 
and limits of variation (either minimum/maximum or 3- 
sigma) for each. These quantities are varied randomly 
over 2000 simulation runs. Various mission and vehicle 
parameters are recorded at certain events throughout the 
simulations. These quantities are evaluated relative to 
MSL project metrics to assess vehicle performance, 
mission risk, and system robustness. Characteristics of 
Monte Carlo cases that consistently fail are identified 
for further investigation by system, vehicle, and mis- 
sion designers. During mission operations as day-of- 
entry approaches and occurs, the POST-based Monte 
Carlo capability can be used to rapidly assess many off- 
nominal conditions to identify several challenging sce- 
narios to be further analyzed using the real-time, hard- 
ware-in-the-loop (DSENDS-based) EDL testbed simu- 
lation. This rapid assessment using the POST-based 
simulation to support detailed subsystem hardware 
analyses using the DSENDS-based testbed permits 
quick, but very detailed analysis of any anomaly that 
occurs as entry is approached. 

Sample Monte Carlo results of 2000 runs for the 70 
deg trim shelf configuration are shown in figures 6, 7, 
and 8. The results at supersonic parachute deploy (see 
Fig. 6) indicate that the parachute deploy constraints on 
Mach and dynamic pressure were met, and the guidance 
delivered the entry system right on its target (note that 
the guidance only acts on the NAV or knowledge state, 
actual states differ due to knowledge error and 
IMU/Navigation error buildup). Figure 7 shows the 
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actual footprint at various EDL events (note that the 
Challenge crater’s edge occurs at about 41.45 S, 
286.28E and 41.45S, 286.75E) indicating that the su- 
personic deploy footprint basically defines the touch- 
down footprint size, but not location. The last figure 
provides histogram information for the touchdown con- 
ditions of the lander. These histograms (see Fig. 8) in- 
dicate that all the cases met the project metric of verti- 
cal touchdown velocity less than 4 m/s and horizontal 
velocity below 2 m/s while maintaining a near zero 
orientation relative to vertical. These figures show only 
a few of the key output parameters generated during a 
Monte Carlo run. A much larger set of date is generated 
with various subsystem design and assessment teams 
interested in different subsets of the data. Using this 
information, overall mission and vehicle statistics as 
well as risk assessments are provided to the MSL pro- 
ject leaders. Further discussion of Monte Carlo results 
can be found in references 1 and 39. 

Validation and Verification 

Each model or dataset that is included into or used 
by the POST-based high fidelity MSL EDL end-to-end 
engineering simulation must complete the validation 
and verification process described below. In this proc- 
ess (summarized in Table 3), both the model devel- 
oper/data provider and the model/data implementer 
must concur before the process is complete. The devel- 
oper is responsible for model formulation and verifying 
that the model and data are correct for the system it is 
supposed to reflect. The developer also is responsible 
for providing computer code of the model formulated 
and verifying that the code produces expected results 
when used in a standalone mode. As such, the devel- 
oper is responsible for providing a set of test data and 
results from the standalone runs. The developer is also 
required to provide expected ranges of key input pa- 
rameters associated with their system and model for use 
in Monte Carlo dispersion analyses. 

The implementer of the model into the POST- 
based simulation must properly include the data or 
software into the simulation and ensure that all the ap- 
propriate interface quantities are provided to the model. 
The model must produce the same output from within 
the POST-based simulation as was produced in the 
standalone test case. Both implementer and developer 
provide their expertise to resolve any discrepancies in 
the output. The implementer then provides sample input 
and output from a typical nominal and off-nominal case 
that can be checked by the developer using their 
standalone capability. When only data is provided, the 


provider is responsible for confirming with the imple- 
menter that results are reasonable for the system that 
the data is provided. 

Some model developers are using their own spe- 
cific subphase simulation for elements such as the entry 
phase only for control system development or parachute 
phase for sizing and dynamics modeling. Validation of 
the results from these subphase simulations with the 
POST-based simulation provides a verification of both. 
Additional verification of the POST-based simulation 
with the real-time, hardware-in-the-loop DSENDS- 
based simulation in discussed in the third part below 
(POST-DSENDS Validation and Verification). 

Future Work 

Development of the POST-based simulation sup- 
porting the MSL mission is continuing. References 37, 
38, 40, 41, and 42 describe various models that either 
have become or are becoming available soon. These 
models (which will be implemented in the POST-based 
simulation in the near future) include a multibody para- 
chute model, surface terrain model, hazard avoidance 
logic, 6 DOF entry and terminal descent control sys- 
tems, reaction control system data and firing logic, a 
navigation filter and associated sensor models, as well 
as LIDAR and RADAR models. The simulation is also 
updated as newer, higher fidelity models of various 
systems and the environment are developed and vali- 
dated. 

PART 2 . END-TO-END EDL REAL-TIME 

SIMULATION TESTBED (DSENDS-BASED) 

The Smart Lander system uses extensive sensor- 
based real-time control and decision making for preci- 
sion landing and hazard avoidance during the entry, 
descent and landing phases. Testing and validating such 
a system requires the use of a high-fidelity, real-time 
spacecraft simulator. The Jet Propulsion Laboratory 
(JPL) is in the midst of adapting its EDL simulator, 
DSENDS (Dynamics Simulator for Entry, Descent and 
Surface landing) [Ref. 4] for use by the Smart Lander. 
DSENDS is an EDL specific extension of the JPL 
Darts/Dshell multi-mission spacecraft dynamics and 
devices simulation toolkit [Ref. 43, 44] used by mis- 
sions such as Cassini, Galileo, etc. [Ref. 45]. 

DSENDS provides for the modeling of the dy- 
namics of tree-topology multi-body systems with flexi- 
ble modes within a real-time simulation. It also pro- 
vides the capability to simulate, in real-time, various 
spacecraft devices such as actuators (e.g. thrusters) and 
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sensors (e.g. IMU's). A variety of EDL related envi- 
ronment models (e.g. gravity, terrain digital elevation 
maps, atmospheric models), are adapted for real-time 
use and support modeling of EDL flight system ele- 
ments such as parachutes, landers, and terrain interact- 
ing instrument simulations (e.g. altimeter, LIDAR). 
Together these capabilities allow the modeling of the 
flight-train dynamics and sensor-based control during 
the Smart Lander EDL sequence. A block diagram of 
the DSENDS architecture and associated model librar- 
ies are shown in Figure 9 and 10. The recent capability 
to include the aerodynamic libraries from POST allows 
high-fidelity aerodynamics modeling, especially during 
the entry phase of flight leading to parachute deploy- 
ment. Planned extensions for landing kinematics and 
dynamics will allow the modeling of contact and impact 
forces associated with touchdown. Nominal as well as 
fault behaviors are incorporated into the device models. 
A state-machine driven model switching capability 
within DSENDS handles spacecraft separations and re- 
configurations such as the example in Figure 1 L Stub 
guidance/navigation controller modules for hypersonic 
steering, parachute activation, hazard avoidance, and 
powered descent guidance/control allow standalone 
simulation as shown in Figure 12 and 13. 

Some of the system engineering issues related to 
the DSENDS system are presented in a companion pa- 
per [Ref. 46]. Here, we focus on a system overview as 
they relate to the real-time architecture of the simula- 
tion. We also briefly discuss the verification of these 
capabilities, including comparisons with off-line simu- 
lators (e.g. POST), mission data (e.g. Mars Pathfinder), 
as well as experimental data (e.g. Smart Lander Rocket 
Sled tests). 

Real-Time Multi-Body Dynamics, 

DSENDS utilizes the Darts multi-body dynamics 
engine developed at JPL. This dynamics engine pro- 
vides for extremely fast computations of rigid and 
flexible body dynamics of a tree-topology multi-body 
system. The underlying computational algorithms for 
Darts are based upon the Spatial Operator Algebra sys- 
tem [Ref. 47] and result in the numerical complexity of 
the dynamics algorithm growing only linearly with the 
number of bodies. Such O(n) algorithms allow high- 
fidelity modeling of spacecraft dynamics without com- 
promising fidelity to meet real-time constraint. Con- 
straining forces and torques between each connected 
body in the multi-body system are transmitted through 
joints that can be of a variety of types. Each body in the 
multi-body system can also be acted upon by external 


as well as by additional inter-body forces and torques. 

In the EDL simulation context, these forces and torques 
represent the actions of gravity, aerodynamic forces, 
and non-linear spring elements between the bodies. The 
underlying dynamics engine also support the notion of 
prescribed motions where forces and torques are de- 
rived from a kinematic specification of the trajectory. 
This allows certain simulation elements to be driven by 
trajectory profiles rather than force/torque applications 
and is useful for modeling elements where the trajecto- 
ries are well known (e.g. from test data) but the 
force/torque relations are not. The rigid-body modeling 
capability allows models for the entry capsule, heat- 
shield, lumped approximations to parachutes, and 
tether/bridle link elements. The flexible-body modeling 
capability allows modeling of lightweight members 
such as landing gear and sensor mounts. The prescribed 
motion capability is potentially useful for certain EDL 
parachute reefing and bridle-lowering models. 

Real-Time Aerodynamics 

DSENDS provides a number of aerodynamics 
models at various levels of fidelity. The highest fidelity 
models are encapsulated subroutine libraries from the 
POST program. These libraries are C routines compiled 
for the Solaris operating system and embed calls to de- 
termine aero-coefficients (as a function of Mach and 
Knudsen number and aerodynamics angles) as well as 
atmospheric models (e.g. MarsGram [Ref. 48]). Other 
lower fidelity models available for use in DSENDS 
include analytical linearized as well as table-interpo- 
lated models for aerodynamics coefficients, stand-alone 
encapsulations of the MarsGram atmospheric database, 
and several table-driven models of atmospheric density 
and temperature profiles. Within the MSL simulation 
project high-fidelity models from POST are the primary 
models used for the entry phases of the flight. These 
models preserve the high-fidelity performance of the 
original aerodynamics databases within POST. During 
the parachute and later descent phases either POST 
derived aerodynamics or the lower fidelity models 
within DSENDS may be used, with the choice deter- 
mined by availability and computational burdens. 

In order to use the libraries obtained from POST 
within a real-time simulation testbed, two options are 
possible. To maintain maximum fidelity it is desirable 
to execute the libraries on the same processor as that 
used for POST execution. The other option is to cross- 
compile the code to the typical processor and operating 
system environment used in real-time testbeds. The first 
option requires the utilization of a Sparc® processor 


10 

American Institute of Aeronautics and Astronautics 



with the Solaris® operating system (from Sun Corp). 
The second option would require cross-compiling to a 
VxWorks® operating system (from WindRiver Corp), 
on a PowerPC® or other similar target system. We have 
chosen to use the first option where the code libraries 
from POST can be received in binary object form and 
source code deliveries are not necessary. We have suc- 
cessfully verified the real-time performance of the 
POST libraries using the real-time operating system 
features within the Solaris® operating system. 

Embedded Real-Time Architecture 

The Darts/Dshell toolkit operates in standard work- 
station based environments such as Solaris®, Irix® 
(from SGI Corp), and Linux® as well as in a real-time 
embedded environment such as VxWorks®. In addi- 
tion, Darts/Dshell supports the VxSim® emulation of 
the VxWorks® system on a workstation. As DSENDS 
is implemented in Darts/Dshell, all of the execution 
environments supported by Darts/Dshell are also sup- 
ported by DSENDS. The real-time Darts/Dshell execu- 
tion tool supports the loading of core C/C++ library 
modules cross-compiled to the appropriate target hard- 
ware platform. Models of the spacecraft dynamics and 
devices are instantiated at run-time and sorted into an 
execution order defined by the partial ordering derived 
from the data dependencies established during the defi- 
nition of model input, output and connectivity. The 
Darts/Dshell architecture also provides a mechanism to 
utilize multiple embedded target CPU’s to provide 
computational speedup. This allows inherent parallel- 
ism in the data-flow computations within the simulation 
system to be exploited. Simulation execution time is 
only constrained by the longest path through the graph 
representing the partial ordering constraints dictated by 
the data flow. 

A user interface built upon the Tel [Ref. 49] inter- 
preter provides for convenient model definition, load- 
ing, simulation scripting and run-time interaction. This 
interface is typically only executed in the initialization 
phase of the simulation so as to not impact the real-time 
performance. An interface to the real-time data graph- 
ing tool Stethoscope® from RTI Inc., and an optional 
message passing interface to a workstation-based 3D 
visualization tool built upon the Open Inventor® 
graphics standard, provides the real-time engineering 
instrumentation into the simulation tool. The simulation 
time may be advanced by means of an interface to a 
real-time clock provided by the embedded system. All 
command inputs and data outputs to the flight-software 


component of the embedded testbed system are pro- 
vided as time-tagged simulation data. 

Real-Time Terrain Access and High-Speed 
Instrument Simulations 

Terrain products are required within the DSENDS 
real-time simulation to support a number of applica- 
tions such instrument simulations (e.g. a terrain scan- 
ning Lidar), data monitoring modules (e.g. a monitor of 
the spacecraft height over the ground), and 3-D visuali- 
zation of the simulation. The location, extent and spatial 
resolution of the terrain segments required to support 
these applications varies and is a function of the bore- 
sight, field-of-view, and the fidelity desired. For exam- 
ple, a Lidar with a steering mirror could require terrain 
anywhere within the field-of-regard provided by the 
mirror at a resolution that is a function of the instanta- 
neous field-of-view (IFOV) of each pixel in the Lidar 
detector. 

The requirements of real-time operation require 
that terrain Digital Elevation Maps (DEMs) be provided 
in a timely manner to the various EDL device models. 
Instrument responses must be generated in synchroni- 
zation with a real-time clock with no possibility of cy- 
cle-slips and consequent data loss. One option would be 
to have all of the terrain resident in memory for imme- 
diate access by the requesting EDL model. This is not 
feasible because of the sheer size of the data set re- 
quired. For example, a 10 km x 10 km site at 10 cm 
resolution would required storage of 10 A 10 pixels! In- 
stead, a process of terrain generation (or enhancement 
in the case of synthetically augmented natural terrain) 
must be combined with terrain segment transport to the 
simulator, followed by upload to the simulator's mem- 
ory. DSENDS implements a real-time interface to a 
Terrain Server database system to support these func- 
tions. The Terrain Server uses multiple fast processors 
to generate the terrain. Timely transport of data to 
DSENDS is made possible by using fast network hard- 
ware and protocols. Finally, real-time buffers and 
shared-memory segment are managed within the EDL 
simulation to achieve real-time terrain access. Note that 
the terrain generation operation can take many seconds, 
transport usually takes a fraction of a second, and buffer 
management/swapping is done at simulation rates e.g. 
50 ms. As new terrain segments are needed by the 
simulation, successive terrain segments must be gener- 
ated as needed, uploaded to the simulator, and placed 
into memory in a timely and seamless fashion. 
DSENDS has a number of real-time shared memory 
buffers that contain overlapping terrain segments. As 
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the model requests terrain in the overlapping areas, 
buffers are switched in real-time to allow the applica- 
tion to access terrain in the new segment in a seamless 
fashion. The simulator also uses a predictive model of 
terrain usage to predict the extent, resolution and extent 
of terrain segments required by the application. These 
predictive models are usually based upon a nominal 
EDL scenario and the current location and velocity of 
the ground '’footprint” of the instrument/viewer field- 
of-view. These predictions, together with knowledge of 
terrain generation times, data transport times, and 
buffer sizes are used to sequence the generation, trans- 
port and upload of appropriately overlapping segments 
of terrain into the EDL simulator. An example scenario 
indicating successive terrain generation and use re- 
quests is illustrated in Figure 14. DSENDS manages the 
use (and reuse) of the real-time buffers, the extent of 
overlap, and provides a level of cache management 
(e.g. keep adjacent terrain segments in memory in case 
they are needed) to relieve the simulator from frequent 
interactions with the terrain generation/transport proc- 
ess. In addition the design provides for backup terrain 
(with lower resolution and larger spatial extent) in case 
the generation/transport process fails to achieve the 
times predicted by its model, or if the predictions of 
anticipated application terrain request turn out to be 
wrong. 

Verification 

Verification of DSENDS real-time system occurs 
in two phases. The first phase compares data from the 
real-time simulation with a workstation based Darts/ 
Dshell simulation executing the same simulation and 
model configuration. Then the workstation data is com- 
pared against external data sources. These include com- 
paring the DSENDS aerodynamics model output data 
with POST simulator data, as well as published data on 
various Mars mission data sets [Ref. 51, 33]. The 
multibody and flex-body dynamics is verified as part of 
the overall Darts/Dshell tool verification. 

Specific device model verification is performed by 
comparing DSENDS model output with test data from 
various Smart Lander Test programs such as Rocket 
Sled Lidar tests [Ref. 50] and future MSL 
Drop/Descent tests. The approach here is to develop 
simulations that model the test configuration and de- 
vices. Comparison of test data and the simulated test 
data provides for verification of model performance. 


PART 3. PQST-DSENDS VALIDATION AND 
VERIFICATION 

In addition to the validation and verification proce- 
dures outlined above, the POST-based high fidelity 
engineering and the DSENDS-based real-time simula- 
tions will be used to cross validate the engineering 
models common to both simulations as well as provide 
a verification check of the entire EDL trajectory. The 6- 
DOF, POST-based engineering simulation with the 
highest fidelity models of lander systems and the Mars 
environment will be used to compare various test case 
results with those produced by the DSENDS-based 
real-time simulation for the same tests. The exact test 
and validation plan is being developed, however the 
basic approached has been identified. 

Three levels of testing will be made using these 
simulations. Unit tests of specific subsystem models 
will occur first. Next, portions of the EDL will be used 
with certain models simplified while others are tested. 
Finally, the full end-to-end simulations will be used for 
nominal and off-nominal runs. 

The unit tests will focus on particular models that 
can be easily isolated. Models such as the control sys- 
tem, aerodynamics, and guidance algorithms can be 
tested while using very few additional models that can 
be very simplified. For example, the entry control sys- 
tem can be tested for an exoatmospheric case using a 
spherical gravity model and a simple open-loop square 
wave command about a single axis. This test would 
focus on the control system response to the given inputs 
in both simulations. Results from tests such as these are 
expected to match very closely. 

The next level of testing will continue to involve 
simple models, but will focus on more Lander specific 
models from a given segment of the EDL trajectory. 
For instance, the entry phase can be tested using the 
high fidelity guidance and control system, while main- 
taining simple vehicle, atmosphere, and gravity models. 
After obtaining a satisfactory comparison of results, the 
fidelity of the other models will be increased until an 
entire phase is simulated to the highest fidelity that the 
6-DOF, POST-based simulation can support. Some 
tests using off-nominal values of key parameters will 
also be included. Further increases in the model fidelity 
for the DSENDS-based simulation (such as including 
tank slosh effects), will result in a divergence of results, 
but the difference should be small and within an ex- 
pected range. 
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Finally, the validated segments will be brought to- 
gether until the full end-to-end EDL simulation is veri- 
fied using both simulations. Tests will involve nominal 
and off-nominal cases. Once again, the initial tests will 
be to the highest fidelity the 6-DOF, POST-based 
simulation can support, and then the DSENDS-based 
simulation will increase model fidelity to ensure there is 
no significant change in the validated results. This test- 
ing will also serve to provide a methodology by which 
future off-nominal cases will be identified from the 
POST-based Monte Carlo runs for more detailed analy- 
ses using the DSENDS-based real-time simulation. 

To summarize, testing will involve unit tests of 
specific model using simplified versions of other mod- 
els. Testing will increase in number of models and fi- 
delity until entire EDL segments are included. Then, 
full end-to-end simulation comparisons will be made 
using the highest fidelity the POST-based simulations 
can support. Initially, simulation result comparisons for 
the unit tests are expected to match very closely. As the 
tests and the models become more complex, some di- 
vergence in results is expected especially as the model 
fidelity in the DSENDS-based simulation exceeds that 
of the 6-DOF, POST-based simulation. 

CONCLUSION 

The development of DSENDS-based real-time, 
hardware-in-the-loop EDL simulation is complemen- 
tary to the utilization of the POST-based high fidelity 
engineering simulation for the Smart Lander project. 
Using both simulations allows the comprehensive test- 
ing of EDL systems and flight software as well as vehi- 
cle performance and mission risk assessments in a uni- 
fied manner across the Smart Lander design, develop- 
ment and operations life-cycle. Additional project risk 
reduction is obtained by using the overlap in capability 
between the simulations to validate them and their 
models against each other. The availability of such 
simulators will significantly reduce the risk associated 
with EDL development of the current and next genera- 
tion of Mars Smart Lander and Sample Return. 
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Table 1. Current EDL Simulation Sequence and Data 

Configurations 70° Trim Shell (2196 kg 4.05 m dsa L/D -0 24). 

CG Offsel ( 1 683 kg, 3 75 m c&a, L/D -0.18) 

• initial delivery and knowledge covariances (radiometric, optical) tor October 201 0 entry 
provided 60 min prior to atmospheric mlertace (JSC IMU/NAV model) 

Nomina) entry PPA ot -14 5 deg 

• Atmospheric interface 

Flight path control by bank angle commands from entry guidance 

- Mars*GRAM 2001 and 2010 entry date (nominal dust TAU=0 45) 

- Chia-Yen dispersed wind model (zero mean wind) scaled up to 30 m/s max winds 

• Supersonic chute deploy 

- Guidance initiated event 

- Nominal C u = 0 61 . d*ameter= 16 15m MPF Mach efficiency and inflation model 

- Minimize miss distance and achieve Mach dynamic pressure MER type Viking 
qualification box (Dynamic Pressure 239-850 Pa. Mach Number 1.13-2.2) 

• Supersonic chute and back shell separation, subsonic chute deploy 

- Mach= 0 8, nominal C 0 = 0 85, diameter= 30 5m, MPF inflation model 

• Heatshield separation 

- 10 sec after subsonic chute deploy 

■ Radar altitude and velocity lock-on 3 sec after heatshield separation 

- Pollard radar model 

- Track allitude AGL • check against 10 km limit 

• Lidar lock-on 1 .5km actual altitude AGL (currently track event time only) 

• Terminal Descent Engine start 

- Guidance initiated 

- Engines start to 20% lor 2 sec on subsonic parachute 

• 6 - 3047 N. 15° canted, throttle (in groups of 2 20-100*4 capability) Isp variable 

• Subsonic chute separation (2 sec after engine start) 

- Touchdown target defined as analytic impact point 

• Target re-designated at 300m above surface to 100m from analytic impact point in 
uniform distributed direction (for Monte Carlo dispersion analyses only) 

■ Radar Shut-off at 1 0 m above surface (no further updates) 

• Constant velocity phase 

- Start 5 m above surface 

• All engines cut off 1 m above surface 

• Landing 

- EDL Challenge site (41 45° S, 286 5° E), -2500 m above MOLA areoid 

Table 2. High Fidelity Simulation Inputs & Responsible 
Organization 


Braun, R. D. et al, “Six Degree-of-Freedom At- 
mospheric Entry Analysis for the Mars Pathfinder 
Mission,” AIAA 95-0456, 1995. 
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Table 3. Validation and Verification Process for POST- 
based Engineering Simulation 

Model Developer 

1 ) I ormulales and Validates model 

2) Develops and Validates computer code representation 

3) Develops standalone test case 

4) Provides Monte Carlo variables {types and variation) 

Simulation Integrator 

1 ) Implements model code into simulation 

2) Demonstrates that test case can be duplicated 

3) Provides test case results to model developer tor confirmation 

4) Develops typical simulation case - provides results to model developer for 
conllrmation 



10 June 2002 


Figure 1 . MSL Lander Entry, Descent and Landing 
Sequence. 


Table 4. Monte Carlo Parameters and Variations 
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Figure 2. MSL EDL Simulation Strategy Overview. 


roll direction 



Figure 3. POST-based Simulation Models and Data 
Flow. 
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Figure 7. Sample Monte Carlo Results of Footprints 

Figure 4. Altitude Calculation Parameter Definitions. Throughout EDL (Trim Shelf Configuration). 



Figure 5. Hypersonic Aeromaneuvering Through Bank 
Angle Modulation. 


Mars Smart Lander EDL Simulation - Reference Mission 
Touchdown Characteristics 
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Figure 8. Sample Monte Carlo Results at Touchdown 
(Trim Shelf Configuration). 
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Figure 6. Sample Monte Carlo Results at Supersonic Figure 9. DSENDS Block Diagram. 

Parachute Deploy (Trim Shelf Configuration). 
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VEHICLE DEVICES 
Sun/Star Sensor; Inertial 
Sensors. Thrusters: Power; 

SPACE ENVIRONMENT 
Epheineris, Gravity Terms; 
Orbital Dynamics; Solar 
Wind 



VEHICLE DY NAMICS 

Rigid! lex Body Physics; 
MnUihody Systems. Ctl 
Change, Body Deploy, 
Fuel Slosh 




ATMOSPHERE & 
AERODYNAMICS 

Hypersonic, Transonic. 
Subsonic Force Thermal. 

Parachutes & Drag Devices. 
Winds; Control Surfaces 




TERRAIN Material 



Properties Terra in- Vehicle 

LANDING SYSTEMS 
Hazard Sensor - Lidar. 

Radar. Orbital Beacons. 
Telecom Link Geometiy: ] 

Airbags. 



Geometry 
Elevation Maps, 




1 ending Snakes 

Albedo; Thermal Inertia 

BUOYANCY SYSTEM 
Envelope. Inflation 



Figure 12. Screenshots from DSENDS Simulation 
Console. 


Figure 10. DSENDS usage of the Darts/Dshell Model 
Library. 
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Figure 11. DSENDS Multibody Models for Flight 
Elements. 



Figure 13. DSENDS Simulation Data Examples for 
G-Load, Fuel-Consumption, and Parachute Angular 
Motion. 
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Fig 14. DSENDS Example Usage of Terrain During 
Spacecraft EDL. 
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